Language models suffer from adversarial vulnerability, where imperceptible perturbations in inputs can mislead model predictions. Existing adversarial training methods enhance model robustness by augmenting training data with worst-case adversarial perturbations for each input. However, these approaches overlook the intrinsic causal relationships within data. We construct causal graphs to model the behavior of encoder-based language models under adversarial inputs, suggesting that adversarial vulnerability is often associated with the model’s overfitting to spurious correlations. Within the adversarial training framework, we formulate expressions for Total Effect (TE) and Natural Direct Effect (NDE), and propose a causal regularization objective based on TE-NDE alignment. Experiments on five benchmark datasets show that this causal adversarial training framework improves adversarial robustness across different settings. We further evaluate the model behavior in a controlled sentiment analysis setting, where the quantitative results provide additional evidence for the effectiveness of our method.
This paper proposes a novel LVLM attack method, called BadPhase with further backdoor designs, to implant adversarial phase as triggers into any image inputs via data poisoning so as to control the LVLMs’ predictions and finds that LVLMs are sensitive to the phase-aware image structure.
Daizong Liu, Junhao Dong, Xiang Fang et al.· 0 citations
A collaborative adversarial fine-tuning framework that maintains multiple experts during training, enables knowledge exchange through embedding-space harmonization, and consolidates the learned knowledge into a single unified robust model.
Nguyen Duc Thai, Junhao Dong, Sua Qi Rong et al.· 0 citations
Adversarial training (AT) is a widely adopted defense against adversarial attacks, but its multi-step optimization process for generating adversarial examples leads to substantial computational overhead. To mitigate this, various single-step adversarial training methods have been proposed. However, these models often suffer from catastrophic overfitting under larger perturbations and exhibit degraded robustness. The core issue is that certain single-step adversarial examples, although successfully learned and correctly classified, fail to expose the true vulnerabilities of models. We refer to these misleading examples as “fakers”. Specifically, we find that fakers exhibit three distinct characteristics compared to standard adversarial examples: 1) they unexpectedly degrade the model robustness rather than improve it; 2) they make it harder for the model to learn their robust features; and 3) they show significantly greater divergence from their clean counterparts. These observations motivate us to proactively reduce the impact of fakers during training. To this end, we propose the Faker-Alleviating Single-step adversarial Training method (FAST), a general and effective framework designed to enhance both accuracy and robustness. Concretely, FAST consists of two main components. First, it dynamically adjusts the label-smoothing level for adversarial examples according to their learning difficulty, making fakers easier for the model to learn. Second, it introduces an auxiliary sample with a weak adversarial effect, derived from the single-step adversarial example, which is used to dynamically ease the alignment with clean data and stabilize the optimization process. We demonstrate the effectiveness of FAST through extensive experiments, showing that our method achieves superior clean accuracy and robustness against various types of adversarial attacks. The code is available at https://github.com/mesunhlf/FAST.
Lifeng Huang, Yuquan Lin, Chen Wan et al.· IEEE Transactions on Informa...· 0 citations
This survey provides a comprehensive analysis of adversarial prompting strategies, ranging from input manipulation techniques to semantic and structural distortions, and explores defense strategies across preprocessing, model-level, postprocessing, and hybrid strategies, highlighting recent advances and their limitations.
A. Nasution, Ahmet Emre Ergün, Aytu˘g Onan et al.· IEEE Access· 0 citations
Safety-critical applications require classifiers that are both robust and reliable. Adversarial training is a widely adopted defense for improving robustness in deep neural networks; however, its effect on the reliability of predictive uncertainty remains underexplored. We investigate this gap through the lens of selective classification, which has rarely been systematically analyzed alongside adversarial robustness. We introduce a unified benchmark for the robustness-uncertainty trade-off. It standardizes architectures, augmentations, threat models, and evaluation metrics across clean, adversarial, and common-corruption settings. Across a wide range of state-of-the-art adversarial training methods, we uncover a recurring failure mode: several approaches improve robust accuracy while degrading uncertainty ranking, leading to poorer selective behavior. To address this, we propose Evidential Adversarial Training (EV-AT), which models uncertainty through a Dirichlet distribution and combines (i) an evidence-based loss promoting clean accuracy and reliable uncertainty with (ii) a robust evidence-alignment loss matching clean and adversarial predictions in log Dirichlet-parameter space. Extensive experiments show that EV-AT shifts the Pareto frontier of robustness-uncertainty trade-offs beyond prior state-of-the-art adversarial training methods. Our source code is publicly available at https://github.com/NicolasSournac/Robustness_Meets_Uncertainty.EV-AT.
Nicolas Sournac, Ahmed Baha Ben Jmaa, B. Braeckeveldt· 0 citations
This work proposes a white-box spectral-subspace-guided attack (SSGRA) that aligns intermediate representations with the subspace spanned by the bottom right singular vectors, offering a spectral interpretation of adversarial vulnerability in VLMs, providing insights for improving their robustness.
Chethan Krishnamurthy Ramanaik, Tobias Callies, Michael Hecht et al.· 0 citations